libhttpserver/examples/file_upload.cpp at 3b434331acd54adde954483b36a63c9e2e270750 · etr/libhttpserver · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
/*
     This file is part of libhttpserver
     Copyright (C) 2011, 2012, 2013, 2014, 2015 Sebastiano Merlino

     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Lesser General Public
     License as published by the Free Software Foundation; either
     version 2.1 of the License, or (at your option) any later version.

     This library is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     Lesser General Public License for more details.

     You should have received a copy of the GNU Lesser General Public
     License along with this library; if not, write to the Free Software
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
     USA
*/

#include <iostream>
#include <memory>
#include <string>
#include <string_view>

#include <httpserver.hpp>

// HTML-escape user-controlled text before placing it in a response body
// to prevent reflected XSS (CWE-79). Never echo unfiltered client input.
static std::string html_escape(std::string_view in) {
    std::string out;
    out.reserve(in.size());
    for (char c : in) {
        switch (c) {
            case '&':  out += "&amp;";  break;
            case '<':  out += "&lt;";   break;
            case '>':  out += "&gt;";   break;
            case '"':  out += "&quot;"; break;
            case '\'': out += "&#39;";  break;
            default:   out += c;        break;
        }
    }
    return out;
}

class file_upload_resource : public httpserver::http_resource {
 public:
     httpserver::http_response render_get(const httpserver::http_request&) override {
         return httpserver::http_response::string(R"html(<html>
  <body>
    <form method="POST" enctype="multipart/form-data">
      <h1>Upload 1 (key is 'files', multiple files can be selected)</h1><br>
      <input type="file" name="files" multiple>
      <br><br>
      <h1>Upload 2 (key is 'files2', multiple files can be selected)</h1><br>
      <input type="file" name="files2" multiple><br><br>
      <input type="submit" value="Upload">
    </form>
  </body>
</html>
)html", "text/html");
     }

     httpserver::http_response render_post(const httpserver::http_request& req) override {
        // Static header built from a raw string literal to avoid per-append
        // reallocations. The dynamic rows are appended after an upfront reserve.
        std::string post_response = R"html(<html>
<head>
  <style>
    table, th, td {
      border: 1px solid black;
      border-collapse: collapse;
    }
  </style>
</head>
<body>
  Uploaded files:
  <br><br>
  <table>
    <tr>
      <th>Key</th>
      <th>Uploaded filename</th>
      <th>File system path</th>
      <th>File size</th>
      <th>Content type</th>
      <th>Transfer encoding</th>
    </tr>
)html";
        post_response.reserve(post_response.size() + 512);

        for (auto &file_key : req.get_files()) {
            for (auto &files : file_key.second) {
                post_response += "    <tr><td>";
                post_response += html_escape(file_key.first);
                post_response += "</td><td>";
                post_response += html_escape(files.first);
                post_response += "</td><td>";
                post_response += html_escape(files.second.get_file_system_file_name());
                post_response += "</td><td>";
                post_response += std::to_string(files.second.get_file_size());
                post_response += "</td><td>";
                post_response += html_escape(files.second.get_content_type());
                post_response += "</td><td>";
                post_response += html_escape(files.second.get_transfer_encoding());
                post_response += "</td></tr>\n";
            }
        }

        post_response += "  </table><br><br>\n";
        post_response += "  <a href=\"/\">back</a>\n";
        post_response += "</body>\n</html>";
        return httpserver::http_response::string(post_response, "text/html").with_status(201);
    }
};

int main(int argc, char** argv) {
    // this example needs a directory as parameter
    if (2 != argc) {
        std::cout << "Usage: file_upload <upload_dir>" << std::endl;
        std::cout << std::endl;
        std::cout << "         file_upload: writeable directory where uploaded files will be stored" << std::endl;
        return -1;
    }

    std::cout << "CAUTION: this example will create files in the directory " << std::string(argv[1]) << std::endl;
    std::cout << "These files won't be deleted at termination" << std::endl;
    std::cout << "Please make sure, that the given directory exists and is writeable" << std::endl;

    httpserver::webserver ws{httpserver::create_webserver(8080)
                              .put_processed_data_to_content(false)
                              .file_upload_dir(std::string(argv[1]))
                              .generate_random_filename_on_upload()
                              .file_upload_target(httpserver::FILE_UPLOAD_DISK_ONLY)};

    auto fur = std::make_shared<file_upload_resource>();
    ws.register_path("/", fur);
    ws.start(true);

    return 0;
}